Fixes the rendering of a SVG filter (e.g. feFlood) by testing against total

Source/platform/graphics/filters/FilterEffect.cpp

 /*
  * Copyright (C) 2008 Alex Mathews <possessedpenguinbob@gmail.com>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  * Copyright (C) 2012 University of Szeged
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 18 matching lines @@
 #include "platform/graphics/UnacceleratedImageBufferSurface.h"
 #include "platform/graphics/filters/Filter.h"
 #include "platform/graphics/gpu/AcceleratedImageBufferSurface.h"
 
 #if HAVE(ARM_NEON_INTRINSICS)
 #include <arm_neon.h>
 #endif
 
 namespace WebCore {
 
+static const float kMaxFilterArea = 4096 * 4096;
+
 FilterEffect::FilterEffect(Filter* filter)
     : m_alphaImage(false)
     , m_filter(filter)
     , m_hasX(false)
     , m_hasY(false)
     , m_hasWidth(false)
     , m_hasHeight(false)
     , m_clipsToBounds(true)
     , m_operatingColorSpace(ColorSpaceLinearRGB)
     , m_resultColorSpace(ColorSpaceDeviceRGB)
 {
     ASSERT(m_filter);
 }
 
 FilterEffect::~FilterEffect()
 {
 }
 
-inline bool isFilterSizeValid(IntRect rect)
+float FilterEffect::maxFilterArea()
 {
-    if (rect.width() < 0 || rect.width() > kMaxFilterSize
-        || rect.height() < 0 || rect.height() > kMaxFilterSize)
+    return kMaxFilterArea;
+}
+
+bool FilterEffect::isFilterSizeValid(const FloatRect& rect)
+{
+    if (rect.width() < 0 || rect.height() < 0
+        ||  (rect.height() * rect.width() > kMaxFilterArea))
         return false;
+
     return true;
 }
 
+
+bool FilterEffect::isFilterSizeValid(const IntRect& rect)
+{
+    return isFilterSizeValid(FloatRect(rect));
+}
+
 FloatRect FilterEffect::determineAbsolutePaintRect(const FloatRect& originalRequestedRect)
 {
     FloatRect requestedRect = originalRequestedRect;
     // Filters in SVG clip to primitive subregion, while CSS doesn't.
     if (m_clipsToBounds)
         requestedRect.intersect(maxEffectRect());
 
     // We may be called multiple times if result is used more than once. Return
     // quickly if if nothing new is required.
     if (absolutePaintRect().contains(enclosingIntRect(requestedRect)))
@@ skipping 486 matching lines @@
     }
     if (hasHeight()) {
         rect.fBottom = rect.fTop + boundaries.height();
         flags |= SkImageFilter::CropRect::kHasBottom_CropEdge;
     }
     rect = filter()->mapLocalRectToAbsoluteRect(rect);
     return SkImageFilter::CropRect(rect, flags);
 }
 
 } // namespace WebCore